Module schema 

On-disk state schema types per design.md §1.

Structs

AgentSelection

Compact profile resolution recorded at create time.

AwaitingInput

Durable open-discussion state projected from node.awaiting_input.

CallerMergeLink

Immutable provenance for a caller-owned merge. Checked against the intent projection when the transaction is folded, not inferred from Git ancestry.

CallerPiLifecycle

Current generation projection of append-only caller Pi lifecycle history.

CallerPiSession

Immutable caller-owned native Pi session identity. This is an association, not evidence of writer quiescence, history retention, or settlement authority.

CallerSettlementIntent

One durable, single-run settlement fence. Never cleared by failed attempts.

ChildRef

(child_run_id, child_node_id) pointer recorded in Node::children.

Event

One event-log line (design.md §1.4).

Manifest

manifest.json (design.md §1.2).

MergeTxn

A durable, in-flight run merge transaction recorded by merge.started BEFORE the git mutation, and the sole input to deterministic merge-crash recovery (design.md §2.1b / A2, issue merge-transaction-recovery).

Node

Durable nodes/<node-id>.json projection (design.md §1.3).

NodeId

A validated node identifier: n- followed by 4 or more ASCII digits (e.g. n-0001). Mirrors what crate::format_node_id emits.

RetainedDisplay

Durable identity of one inert completed-worker display.

RunId

A validated run identifier: a lowercase ULID (26 Crockford base32 characters whose first character keeps the encoded timestamp within ULID’s 48-bit range). Mirrors what crate::new_run_id emits.

SelectedAgentCandidate

Exact selected candidate pinned for launch and retry.

SkippedAgentCandidate

One rejected candidate and its first applicable reason.

TmuxIdentity

A fully-qualified tmux window identity recorded at spawn time.

TmuxRetentionPolicy

Opt-in policy recorded on a run placed in a persistent tmux session.

WorkerEvidence

Durable native Pi session and terminal evidence for one worker attempt.

WorkerExit

The observed exit status of a node’s worker process, recorded by the run-worker launcher shim under the run lock (design.md §2.1 / A1).

Enums

AgentOwner

Who launches and owns the agent. This is independent of lifecycle: an interactive Taskfleet worker is still a Taskfleet-owned worker.

CallerPiState

A caller attests a Pi lifecycle transition. This is not a worker exit or proof of quiescence: only an external writer-fence protocol can authorize settlement. The event log retains every distinct transition.

EvidenceStatus

State of durable native worker evidence capture.

IdValidationError

Error returned when a typed identifier fails parse-time validation.

Kind

The run/node kind enum (design.md §1.2).

Lifecycle

How a run is driven — its how-run state (design.md §2, §6).

SettlementOperation

Sticky caller-owned settlement operation. An intent is not a terminal report.

Status

Run/node status (design.md §1.2).

Constants

STATE_SCHEMA_VERSION

The current state-on-disk schema version this crate writes.

SUPPORTED_STATE_SCHEMAS

All state-schema versions this crate can read.

Functions

aggregate_terminal_status

Aggregate a set of node statuses into the run’s rolled-up terminal status, or None when the run is not yet complete.

is_run_id_prefix

True iff s is a syntactically valid (possibly partial) prefix of a RunId: non-empty, no longer than a full ULID, every character a lowercase Crockford base32 digit, and a first character within ULID’s 0..=7 timestamp bound. Used by the CLI to resolve an unambiguous run-id prefix (like git) — a value failing this is a malformed argument (invalid_run_id), not a legitimate-but-unknown prefix. The first-char bound is enforced because no valid RunId can begin outside 0..=7, so an 8…/9… prefix is impossible rather than merely absent — reporting it as malformed keeps the error class honest and consistent with how RunId::parse_str rejects a full-length id with the same leading digit.